Amendments to the Specification; 

Please amended the Sepcification as follows, 
attached hereto. 



A Substitute Specification in clean form is 



COMPUTER IMPLEMENTED METHOD PROVIDING SOFTWARE VIRUS INFECTION 
INFORMATION IN REAL TIME 

TITLE OF THE INVENTION 

Field of the invention 

rOOOll Computer Implemented Method Providing Software Virus Infection Information In 
Real Time 

BACKGROUND OF THE INVENTION 
r00021 The present invention relates generally to the field of data processing systems and 
data communications for personal computers (PCs) and in particular to a computer implemented 
method intended to provide in real time and using a communication network, in particular a 
global one, such as the Internet, computer infection information to multiple users with regard to 
computer or software viruses extend or spread on a particular geographical area (location and 
time) and also about the trend of expansion of a virus or viruses helping in this way in alerting 
said to alert users in order to better cope with detected viral programs. 

[00031 The method according to this invention provides information about real risk that users 
placed at different locations and connected through a communication network network, face of 
being infected by a computer virus and the resulting damage it can cause at any given moment, at 
any of said different locations. In particular and according to a preferred e mbodim e nt 
embodiment, the method allows any computer user to see the virus infection status in any region, 
country, and continent or even across the whole world at [[a]] first sight or for example just by 
selecting a geographical area such as a country from a drop-down menu. 

[0004] Therefor e Therefore, this method while providing a real-time monitoring of computer 
virus activity in a region and in general across the globe, will aid computer users, through the 
given information and special warnings provided, to cope at any moment with any computer 
virus situation and avoiding that thoy to avoid unknowingly and innocently contribute to spread 
computer viruses. 
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Background of th e invention 



r00051 Since the 1990s, viruses have become a serious problem. Many nasty viruses do 
irreversible damage, like deleting some or all of the user's files. The Internet is quickly 
becoming the preferred data communications medium for a broad class of computer users 
ranging from private individuals to large corporations. Such users now routinely employ the 
Internet to access information, distribute information, correspond electronically, and even 
conduct personal conferencing. An ever-growing number of individuals, organizations and 
business have established a presence on the Internet through "Web pages" on the World-Wide- 
Web. It has to b e remarked that nowadays Nowadays, millions of computers are interconnected 
through the Internet, which has become a real global network. 

r00061 As the popularity of the Internet has grown, so too have concerns about breaches in 
system security, such as computer or software viruses, which may be introduced by data 
downloaded from the largely-unregulated network. Existing virus scanning utilities typically are 
installed on end-user systems, but this approach pr e s e nt s presents, in some cases cases, potential 
problems. Firstly Firstly, if the virus scan utility is not regularly updated, infected files may still 
reach a user's system, for example, downloaded from a network or copied from an external 
storage device without the user's knowledge. The infected data may reside undetected on the 
user's system for a long period of time, for example, until the next time the user updates his/her 
antivirus anti-virus software and does a complete system scan, which many users do no more 
frequently than weekly, if at all. In the meantime, the user may inadvertently pass the infected 
file to other users. In addition, users may forget to leave virus checking software running, 
thereby providing infected data with an opportunity to infiltrate their system, and also the virus 
checking or anti-virus software used may be outdated, that is i.e., lacking the latest known virus 
pattern files. 

[00071 It is known to provide anti computer virus programs that apply tests for a large 
number of known virus types and characteristics. If a computer virus is detected, then a warning 
is issued to the user and the user is given the option to delete, quarantine or clean the infected 
file. 



3 



[0008] US 2002/0103783 discloses [[a]] decentralized virus scanning for stored data, such as 
for example in a networked environment to cope with problems unique to specialized computing 
devices such as servers, providing protection at the source of the files. 

r00091 US 2002/01 16639 propose a method and apparatus for providing a business service 
for the detection, notification and elimination of computer viruses for handling a virus in a large 
network of data processing systems or machines. According to this m e thod method, in response 
to detecting a virus infection, a virus scanner and notifier (VSN) residing on a client data 
processing system sends notification of the presence of a virus to a software module residing at a 
remote server through a communication link. Said server may then execute an action based on a 
business policy in response to receiving the notification. 

fOOlOl US 2002/0138760 describes [[a]] computer virus infection information providing a 
method for detecting a computer virus in information transmitted between a terminal apparatus 
and a central apparatus and making availabl e available, from sakl the central apparatus that stores 
the communication history of the information transmitted by terminal apparatuses apparatuses, 
infection information such as the time of infection to the users users, and thereby permitting the 
users to understand the time of infection easily. 

[00111 US 2002/0147915 discloses a m e thod computer program product and method and 
network data processing system for the detection, notification and elimination of certain 
computer viruses on a network using a promiscuous system as bait. 

F00121 The present invention proposes a new strategy not disclosed in previous proposals, 
such as the above mentioned prior art, providing to a computer user in real time and in an 
automatic way information about the existence of active viruses in any particular area where said 
user operates or intends to operate. The information so made available, in general to any user, is 
obtained by collecting information about the results of at least a virus detection operation carried 
out on a big amount large number of computers spread out among several different locations, 
processing the reports issued and allocating then the detected computer viruses in geographical 
areas. 

[00131 The proposed invention also provides information availabl e available, in general to 
any computer user, about the expansion or tendency to spread or expand of said such viruses, 
their identity or name , detailed information on the virus e s virus's behavior, and more risky 
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computer virus e s viruses , Le^ it constitutes a tool acting as a computer viruses forecast, 
providing at the same time virus cleaning and file repair tools for the computer viruses. 
Summary of th e inv e ntion 

BRIEF SUMMARY OF THE INVENTION 
r00141 This invention refers is directed to a method prepared to offer automatic information 
of both a threat level of a particular computer virus and the threat level of the combined action of 
all computer viruses in circulation in a particular geographical area [[e]] or region acting on PCs 
( server servers and/ or work s tation stations) , & Le^ the combined result of the threat levels of 
each active computer virus in said area which can be described as a computer "virus climat e ". 
climate." 

r00151 The proposed method provid e s provides, in feet fact, information allowing knowing 
about the probability of a user being affected by a computer virus in a specific area, at any given 
time, due to the extent of viruses or properties of them (e.g., particular activity, threat level, etc.). 
r00161 The importance of knowing the cited computer "virus climate" can be compared to 
weather reports that help to make decisions before going on a journey. This report should outline 
the probability of being affected by [[a]] computer virus attacks, what type of damage can result 
(a link to a virus information center capable to provide a help or assistance is also given) and 
practical information on how to stay safe. 

[00171 Although computer viruses are a global phenomenon, the inventors have realized that 
sometimes certain computer viruses hit some regions harder than others. For this reason reason, 
the results, i.e., the given information, of the proposed method always correspond to selected 
geographic regions: states, countries, regions, continents or even the whole world. 
[00181 Not all the computer viruses pose the same threat to users. Each virus presents a high 
or low-level threat at any given mom e nt moment, and for this reason according to this invention 
invention, an index has been created to measure a computer virus threat level. A special feature 
of the proposed invention is that a value on said index is specific for each computer virus and it 
is updated in real-time as the virus spreads or the threat recedes: If a virus is spreading rapidly or 
its capacity to damage systems is high it represents a greater threat and vice versa. 
[00191 The method of this invention comprises substantially the following st e ps : 
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a) providing a computer virus utility program to a plurality of users distributed 
around different locations locations, each of them operating at least one local 
computer; 

b) obtaining information about geographical location of each of said local computers 
from said users or by alternating means; 

c) carrying out, using said computer virus utility program, at least a computer virus 
search or scanning operation covering at least a part of at least one hard disk of 
said local computers or at least a part of a unit supporting information connected 
or connectable to said local computers; 

d) issuing a report containing the results of the search or scanning operation, of any 
computer virus detected after finishing said at least a computer virus scanning or 
search operation on at least a part of said local computer and automatically 
making available the results of said report through a communication network 
along with at least data of location of said local computer, to a remote center; 

e) processing at said center the plurality of reports received from different local 
computers and allocating said detected computer viruses in geographical areas; 
and 

f) making available information about at least the most active computer viruses at a 
given time in a series of geographical areas enabled to be selected corresponding 
to said different locations of step a) and about the percentage of infected 
computers in each of said geographical areas. 

r0020] Step f) is periodically updated and the information made available is provided 
preferably through a local [[e]] or global communication network such as the Internet. 
f 00211 While to implement the proposed method steps a) to e) need to be carried out, the 
information made available at step f) can be made accessible to any user (without either execute 
steps a^b^e a, b ,c) on his/her computer) by simply connecting through a communication network 
to a particular site offering it. 

r0022] According to a preferred embodiment , the step of said making available the results of 
said the report at step d) to a center is done preserving anonymity of the users having executed 
step c). 
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[00231 The step Step c) is performed in general in response to a petition of said user to which 
the features of the method are presented in general through a communication network and from a 
site such as a Website (Internet). 

[00241 Also the step making the results available at step d) is done according to a preferred 
alternative after prompting a petition to the user of the local computer and obtaining an 
authorization to send the issued report. 
Brief description of th e drawings 

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
[00251 The foregoing summary, as well as the following detailed description of preferred 
embodiments of the invention, will be better understood when read in conjunction with the 
appended drawings. For the purpose of illustrating the invention, there are shown in the 
drawings embodiments which are presently preferred. It should be understood, however, that the 
invention is not limited to the precise arrangements and instrumentalities shown. 
[00261 In the drawings: 

[00271 Fig. 1 attached to this specification provides a basic diagram of a global 
implementation of the proposed method method; 

[00281 Fig. 2 shows a schematic representation of the exposed status of virus infection risk 
risk; 

[00291 Fig. 3 shows a map indicating the level of infection in different parts of the world 
world; and 

[00301 Fig. 4 is an alert panel according to one embodiment of this invention showing the 
level of infection at a global or local level according to a color representation indicative of the 
level of infection. 
Detailed d e scription 

DETAILED DESCRIPTION OF THE INVENTION 
[00311 The method of this invention comprises substantially performing steps a) to f) 
previously detailed. As previously stated and according to a preferred embodim e nt embodiment, 
any user, once the method has been put into operation (i.e. by several users at many different 
locations having executed steps a) to e)), can have access to the information of step f) by simply 
reaching a particular site through a communication network such as the Internet. 
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r00321 Sai4 The computer virus utility program includes anti-virus software that can reside 
temporally or permanently in a local computer. 

r00331 According to a preferred embodiment, the information provided at the step 0 is 
periodically updated information obtained as a result of the plurality of reports processed at step 
e). In general general, said the information is renewed and issued as soon as new batches of 
reports from any particular geographical area are processed by said center at step e). 
r00341 Alternatively Alternatively, $a*4 the periodically updated information of step 0 is 
renewed each predetermined period of time. 

[00351 The process of step e) at said the center includes statistic operations of the data from 
the plurality of issued reports received. 

r00361 In particular, processing operations carried out at step e) will include an evaluation for 
each of sai4 the geographical areas of the number, name and expansion of detected computer 
viruses.[[r]] 

[00371 Therefore the information provided at step 0 will also include the extent of some of 
said most active detected computer virus at any given geographical area. 

[00381 Additionally this information will preferably include the trend of spread of all of sai4 
the most active detected computer virus at any given geographical area, during an immediate 
preceding period of time, the duration of which will be indicated. 

[00391 In a preferred e mbodim e nt embodiment, step a) of providing said computer virus 

utility program is carried out on line, downloading a computer virus utility program from a site of 

a remote provider which also can be a site providing anti-virus tools to the users. 

[00401 Steps a) and b) can be performed sequentially at any given order. If step b) is the fifst 

first, an indication about the fact that the requested information about geographical location will 

provide access or allow obtaining a link to a computer anti-virus service will be given. 

[00411 Step c) can include a heuristic exploration of sai4 the local computer in order to detect 

some files suspected to be infected, the results being also specifically detailed as suspected files 

in sa& the issued report. 

[00421 According to a preferred embodiment of the invention invention, if any computer 
virus is detected in the step [[e)]] c^ a virus cleaning and file repair operation could be performed 
which can comprise: 

eliminating the detected computer virus from an infected file or files; 
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take taking away the adverse effects caused by a virus on the infected computer; 
and 

remove removing an infected file or files from said local computer. 
f00431 Optionally Optionally, the infected file or files can be quarantined. 
r00441 Furthermore step c) can selectively be performed: 

on the whole or on only a part of the hard disk of said local computer; 

on an area interchanging messages of said local computer; or 

on an external unit supporting information connected or connectable to said the 

computer; 

on one or more files which can be selected. 
r00451 In a preferred implementation of the invention invention, step d) will include 
prompting a petition to the user of the local computer in order to obtain an authorization to send 
the issued report before it b e ing is effectively sent through a communication network to said the 
remote center. 

[00461 The issued report of step d) will includ e include, in gen e ral general, the number of 
times that a detected virus appears in the virus detection operation performed on a local computer 
at step c). 

r00471 Said The report can also include the number and name of the computer virus/es 
virus(es) found. In addition, the number and kind of infected files can also be reported. 
r00481 In step [[d)]] in addition to the geographical location of each local computer, 
information about the time of the virus scanning operation or performed report is issued. 
Alternatively Alternatively, said the report obtained in step d) can further include the time at 
which said the report is sent to said the center. 

f00491 As an option, information about the computer operating system of said the local 
computer can also be included in said the issued report of step d). 

[00501 The referred plurality of local computers a*e are^ in general, distributed around a wide 
geographical area including at least two distant regions or States of a country or even all the 
world if the communication network is a global network such as the Internet. 
[00511 However However, the effectiveness of the proposed method will also be apparent 
when using a particular network such as a large company network covering a plurality of local 
computers located at different areas (regions or countries). Th e proposal of this The present 
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invention clearly differentiates of th e over that disclosed in the cited US 2002/01 16639, by i 
providing in this cas e in addition to performing a cleaning m and file repair operation an 
immediate information about degree of proliferation of a single computer virus or combination of 
viruses in a particular geographical zone where a user is located, intends to operate or is 
interested e» in operating. 

r00521 The referred computer virus utility program, the computer user downloads for 
example from an Internet site to start the method and which could reside only temporally on said 

i 

the local computers, is in addition periodically updated including special anti-virus tools to fight 
against a newly detected computer virus newly detected . 

100531 Said The computer virus utility program can include a communication program 
through which issued reports of step d) are being sent but in general a communication network 
such as a global (Internet) [[e]] or large local one will be used. 

r00541 According to an implemented version, the method of this invention, depicts the 
referred computer "virus climate" in the form of color-coded warning conditions in a way similar 
to that used by emergency services with respect to natural disaster warnings 
[00551 According to a preferred embodiment the following warning conditions and indicative 
colors can be used: 



WARNING 
CONDITION 


DEFINITION 


PREVENTIVE MEASURES 


Green 
(normal) 


Normal status 

No indication about any virus or hoax 
constituting a threat exists 
Low risk of being infected by a 
computer virus or malicious code, 


Apply current preventive measures 
(anti-virus installed, updated and 
properly functioning). 
Be sure that all the computers in 
use are provided with a fully 
updated anti-virus. 


Orange 

(pre-alert situation) 


Pre-alert status 

There are indications of the potential 
of some virus becoming epidemic. 
High risk of being infected by a 
computer virus or malicious code. 


In addition to the precautions taken 
under the "green" warning 
condition, apply specific preventive 
measures for the most active 
computer viruses at the time. 
In case of an administrator, plan an 
emergency strategy against the most 
virulent malicious codes in 
circulation or spread viruses. 


Red 
(alert) 


Red alert status 

At least one severe threat computer 
virus or (hoax) or two high threat 
computer viruses are in circulation 
causing an epidemic. 


In addition to the previous 
precautionary measures mentioned, 
apply specific security measures i 
against the severe threat and high 
threat computer viruses that are 
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High risk of being infected by a 
computer virus or malicious code 



active (content filters, installation 
of the corresponding security 
patches, etc.) 



[00561 Fig 2 shows a schematic representation of the exposed status of virus infection risk, 
calculated by statistic operations carried out on the data from the plurality of issued reports and 
processed at step e). 

[00571 Fig. 4 shows an alert panel indicating the level of infection at a global or local level 
according to sat4 the indicative color representation and including a time reference and 
alternatively (while not represented) the name of a local area. 

[00581 It has to be highlighted that each particular situation especially an amber or red 
warning condition will require specific measures for optimum protection depending of the kind 
of computer virus or malicious code involved. 

[00591 The above indications about the status of computer virus infection risk will in general 
be accompanied by additional information, clearly explaining the threat level of the computer 
virus warning condition. 

[00601 The additional information may include the following: 

region or geographical area to which the warning applies: world-wide, continent, 
country [[e]] or state/region; 

explanation of the severity of the warning condition: for example, when the 
warning condition is red, one or more computer viruses classified as high threat or 
severe threat are in circulation and publication of their names, the threat level and 
the type of systems infected is given; and 

specific recommendations through message boards directed on how to deal with a 
specific computer virus or viruses in particular how to remove it or them or how 
to handle a situation, as well as special al e rts alerts. 
[00611 The information about degree of proliferation of a single computer virus [[e]] or 
viruses, or the combination of viruses in a geographical zone can be obtained by selecting sai4 
the zone from a list. The proportion of infected PG PCs and an indication about the trend of 
spread of the computer virus or viruses is provided by the method. 
[00621 According to the inv e ntion invention, the cited information about degree of 
proliferation of a single computer virus or viruses, or the combination of viruses in a 
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geographical zone can additionally or alternatively be obtained in the form of a map that provides 

the following information: 

top viruses: list of the most active computer viruses in a region; 

top countries: list of the areas most-affected by a single or all computer virus; and 

proliferation of infection graph: displays the development of PCs infected by a 

computer virus or all viruses, in each area from the last 24 hours to the past 12 

months. 

r00631 Usually the map (see Fig. 3) will open as a world map, displaying continents and 
indicating the level of infection using different color codes. If a user eliefc clicks on a continent, 
the map will display an expanded version, with each country colored according to its current 
computer virus status, and a single country can also be selected obtaining more detailed 
information. 

r00641 In addition the cited map offers two options. The first of thes e : these, region, allows 
selecting the geographic area of interest by simply clicking the desired area. The second option: 
option, by infection, allow choosing the name of virus or hoax causing an infection displaying 
the geographic area infected. 

[0065] This virus map provides a live graphic coverage of the impact of computer viruses in 
diverse geographic regions. 

f00661 On the other side, by the panel represented in Fig. 4 one can obtain at a first sight 
quick information about the degree of infection at a global or local level, which can be of help to 
adopt necessary protective measures. 

f00671 It will be appreciated by those skilled in the art that changes could be made to the 
embodiments described above without departing from the broad inventive concept thereof. It is 
understood, therefore, that this invention is not limited to the particular embodiments disclosed, 
but it is intended to cover modifications within the spirit and scope of the present invention as 
defined by the appended claims. 

ABSTRACT OF THE DISCLOSURE 
A computer implemented method providing software viruses infection 
information in real timer time includes: 
It comprises following steps: 
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a) providing a computer virus utility program to a plurality of computer users 
distributed around different locations, locations; 

b) obtaining information about geographical location of said comput e rs, 

computers; 

e) looking for viruses by searching or scanning said computers ; computers; 

d) sending to a center, through a communication network, a report containing the 
results of said computer virus search or scanning op e ration operation; 

e) processing at said center a plurality of reports received from different local 
computers and allocate said detected computer viruses in geographical ar e as, areas; and 

f) making available information about the most active computer virus at a given 
time in a series of selectable geographical areas corresponding to said different locations. 



13 



